Analysis
-
max time kernel
130s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 12:53
Static task
static1
Behavioral task
behavioral1
Sample
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe
Resource
win10v20210408
General
-
Target
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe
-
Size
416KB
-
MD5
438b768038e93e36d90dd1fd034a652b
-
SHA1
aa773322156ac6a74245bfbd0620769726eceafc
-
SHA256
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216
-
SHA512
27d0d71518e71377830f317c5c830587adad717bfdcf89299c71b671776c27de9ca603696fe606d5b87f003f336320c4de096faa2aea7cc8ef124d89d7bb36ec
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Bfjfjbz.pifBfjfjbz.pifpid process 1636 Bfjfjbz.pif 1068 Bfjfjbz.pif -
Drops file in Program Files directory 2 IoCs
Processes:
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exedescription ioc process File created C:\Program Files (x86)\Bfjfjbz.pif f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe File opened for modification C:\Program Files (x86)\Bfjfjbz.pif f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exeBfjfjbz.pifBfjfjbz.pifpid process 2040 f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe 1636 Bfjfjbz.pif 1068 Bfjfjbz.pif -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Bfjfjbz.pifdescription pid process target process PID 1636 wrote to memory of 1068 1636 Bfjfjbz.pif Bfjfjbz.pif PID 1636 wrote to memory of 1068 1636 Bfjfjbz.pif Bfjfjbz.pif PID 1636 wrote to memory of 1068 1636 Bfjfjbz.pif Bfjfjbz.pif PID 1636 wrote to memory of 1068 1636 Bfjfjbz.pif Bfjfjbz.pif
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe"C:\Users\Admin\AppData\Local\Temp\f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2040
-
C:\Program Files (x86)\Bfjfjbz.pif"C:\Program Files (x86)\Bfjfjbz.pif"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Bfjfjbz.pif"C:\Program Files (x86)\Bfjfjbz.pif" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Bfjfjbz.pifMD5
438b768038e93e36d90dd1fd034a652b
SHA1aa773322156ac6a74245bfbd0620769726eceafc
SHA256f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216
SHA51227d0d71518e71377830f317c5c830587adad717bfdcf89299c71b671776c27de9ca603696fe606d5b87f003f336320c4de096faa2aea7cc8ef124d89d7bb36ec
-
C:\Program Files (x86)\Bfjfjbz.pifMD5
438b768038e93e36d90dd1fd034a652b
SHA1aa773322156ac6a74245bfbd0620769726eceafc
SHA256f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216
SHA51227d0d71518e71377830f317c5c830587adad717bfdcf89299c71b671776c27de9ca603696fe606d5b87f003f336320c4de096faa2aea7cc8ef124d89d7bb36ec
-
C:\Program Files (x86)\Bfjfjbz.pifMD5
438b768038e93e36d90dd1fd034a652b
SHA1aa773322156ac6a74245bfbd0620769726eceafc
SHA256f7307b77198e6af1014129704ac6792ad5705bdd25a1fcd44a1df1ef0953c216
SHA51227d0d71518e71377830f317c5c830587adad717bfdcf89299c71b671776c27de9ca603696fe606d5b87f003f336320c4de096faa2aea7cc8ef124d89d7bb36ec
-
memory/1068-67-0x0000000000000000-mapping.dmp
-
memory/2040-59-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/2040-60-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB